MODX Revolution 2.2.14 Cross Site Request Forgery / Cross Site Scripting

41   2019-08-05 08:08   nipc
漏洞信息
漏洞编号: 1325
CVE编号:
漏洞类型: -
漏洞来源: cxs
发布日期: 2014-11-05
CVSS
CVSS值: -
严重级别: 中危
利用范围: -
攻击复杂度: -
认证级别: -
漏洞描述

WLB-2014110015[***]http://cxsecurity.com/issue/WLB-2014110015[***]Bug: MODX Revolution 2.2.14 Cross Site Request Forgery / Cross Site Scripting ( Ascii Version )[***]MODX Revolution 2.2.14 Cross Site Request Forgery / Cross Site Scripting[***]2014.11.05[***]Narendra Bhati[***]Medium[***]CWE-79@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893********CWE-352@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** [***]N/A ( Add )@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** </form>[***]No[***]Yes[***][***][***][***][***][***][***][***][***] Advisory ID: 92152@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Product: MODX Revolution@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Vendor: MODX@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Vulnerable Version(s): 2.0.0 2.2.14@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Tested Version: 2.2.14@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Advisory Publication: 16 July, 2014 [without technical details]@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Vendor Notification: 16 July, 2014 @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Vendor Patch: 15 July, 2014 @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Public Disclosure: 2 November , 2014 @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Vulnerability Type: CSRF Tokens Bypass + Reflected Cross Site Scripting + Stored XSS@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** CVE Reference: Requested@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Risk Level: Critical@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Solution Status: Fixed by Vendor@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Patch - Upgrade to MODX Revolution 2.2.15. Due to the nature of this issue and the number of files requiring changes the@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** solution is to upgrade. No installable patch or fileset is available for prior versions@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Reported By - Narendra Bhati ( R00t Sh3ll)@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Security Analyst @ Suma Soft Pvt. Ltd. , Pune ( India )IT Risk &amp; Security Management Services , Pune ( India)@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Facebook - https://facebook.com/narendradewsoft@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** twitter - https://www.twitter.com/NarendraBhatiNB@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Blog - http://hacktivity.websecgeeks.com@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Email - bhati.contact@gmail.com@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** -----------------------------------------------------------------------------------------------@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Advisory Details:@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** Narendra Bhati discovered vulnerability in MODX Revolution, which can be exploited to perform Cross-Site Scripting (XSS)@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** attacks &amp; Along With Bypassing CSRF Tokens Protection ,Its allow an attacker to perform A CSRF Attack alosing With@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** XSS to take over victim account by changin promary email address , Sending forged request Etc , Tricking an admin to@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** attack on their own users by sending specially crafter malicous payload as CSRF Attack@@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suijishu0518893******** @@@@@@@@@@$$$$$$$$$$&&&&&&&&&&##########suiji

POC

Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Version(s): 2.0.0 2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 [without technical details] Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2 November , 2014 Vulnerability Type: CSRF Tokens Bypass + Reflected Cross Site Scripting + Stored XSS CVE Reference: Requested Risk Level: Critical Solution Status: Fixed by Vendor Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) Patch - Upgrade to MODX Revolution 2.2.15. Due to the nature of this issue and the number of files requiring changes the solution is to upgrade. No installable patch or fileset is available for prior versions Reported By - Narendra Bhati ( R00t Sh3ll) Security Analyst @ Suma Soft Pvt. Ltd. , Pune ( India )IT Risk &amp; Security Management Services , Pune ( India) Facebook - https://facebook.com/narendradewsoft twitter - https://www.twitter.com/NarendraBhatiNB Blog - http://hacktivity.websecgeeks.com Email - bhati.contact@gmail.com ----------------------------------------------------------------------------------------------- Advisory Details: Narendra Bhati discovered vulnerability in MODX Revolution, which can be exploited to perform Cross-Site Scripting (XSS) attacks &amp; Along With Bypassing CSRF Tokens Protection ,Its allow an attacker to perform A CSRF Attack alosing With XSS to take over victim account by changin promary email address , Sending forged request Etc , Tricking an admin to attack on their own users by sending specially crafter malicous payload as CSRF Attack 1) Cross Site Request Forgery Protection (CSRF) Tokens Bypassing in Modx Revolution The vulnerability exists due to insufficient validation of csrftokens ["HTTP_MODHAUTH] at server side which allow an attacker to Perform CSRF Attack by bypassing CSRF Protection Mechanism To take over victim account , Trick him to send malicious request Etc. ------------------------------------------------------------------------------------ 2) Reflected Cross-Site Scripting (XSS) in MODX Revolution The vulnerability exists due to insufficient sanitization of input data passed via the "context_key" HTTP GET parameter to "http://127.0.0.1/day/modx/manager/index.php?a=55&amp;class_key=modStaticResource&amp;context_key=" URL. A remote attacker can trick a logged-in administrator to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website. This vulnerability can be used against website administrator to perform phishing attacks, steal potentially sensitive data and gain complete control over web application. The exploitation example below uses the ""&gt;&lt;/script&gt;&lt;img src=x onerror=prompt(/XSS/)&gt;" JavaScript function to display "/XSS/" word: Vulnerable URL - http://127.0.0.1/day/modx/manager/index.php?a=55&amp;class_key=modStaticResource&amp;context_key="&gt;&lt;/script&amp;g t;&lt;img src=x onerror=prompt(/XSS/)&gt; Vulnerable Parameter - "context_key" XSS Payload - "&gt;&lt;/script&gt;&lt;img src=x onerror=prompt(/XSS/)&gt; "&gt;&lt;/script&gt;&lt;img src=x onerror=prompt(document.cookie)&gt; ----------------------------------------------------------------------------------------------- 3) Stored Cross-Site Scripting (XSS) in MODX Revolution The vulnerability exists due to insufficient sanitization of input data passed via the "context" HTTP POST parameter to " http://127.0.0.1/day/modx/manager/index.php?id=1" URL. A local attacker [Authenticated User] can execute arbitrary HTML and script code in browser in context of the vulnerable website. This vulnerability can be used against website visitors to perform phishing attacks, steal potentially sensitive data and gain complete control over web application. The exploitation example below uses the "&lt;script&gt;alert(1)&lt;/script&gt;" JavaScript function to display "1" word: Vulnerable URL - http://127.0.0.1/day/modx/manager/index.php?id=1 Vulnerable Parameter - "context" XSS Payload - &lt;script&gt;alert(1)&lt;/script&gt; Note - This Stored XSS Was more critical because there was a CSRF protection vulnerability also , which allow an attacker to trick an admin